NetHawk M5 Analyzer versus Wireshark

- Benefits of using a state-of-the-art product instead of freeware

Aug 2011
M5 Analyzer and WireShark Decoder in brief

M5 Analyzer from EXFO NetHawk

› NetHawk is trusted partner in wireless testing since 1991
› Launched in 2005, the M5 combines software for UTRAN, GSM and Core Analysis
› Over 1500 analyzer licenses sold to over 150 customers
› 400+ protocols supported (thousands if baseline versions or applications are calculated too)
› Preferred or Approved supplier at Top-5 Network Equipment Manufacturers

WireShark
› First working version of project originally name Ethereal released around 1998.
(May 2006 the project was renamed Wireshark due to trademark issues)
› Released under GNU GPL license, one person owns the copyrights. In 2010 Riverbed
Technology purchased CACE and took over as the primary sponsor of Wireshark
› 24 Protocol families – main focus at enterprise and application protocols
› Free opensource application – support and development by community only

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 22
Main Reasons to Choose the M5 Analyzer

› Performance and Reliability

› Professional tool with warranty and continuous
development adding new technologies
› Scalable tool with line-rate capture and processing
› Designed for Mobile networks
› The most complete support for 2G/3G/LTE and Core networks with vendor specific
proprietary decoders and network security deciphering
› Additional easy to use timesaving applications for statistics, KPI’s, call tracing, etc.

Does your testing team need a tool that can trace a large number of calls and correlate
different interfaces in realtime? -Then the M5 is the tool for interoperability and live
network analyzing.
A single source of information.

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 33
Performance and Reliability

› M5 Protocol Analyzer Hardware is selected and tuned for performance.

› To provide real-time capture and analysis of live traffic, EXFO NetHawk
has a team of professional engineers selecting, building and tuning the
various hardware and software components of the company’s offerings.
› Loading WS onto a PC, even one with the best performance possible,
cannot compare in terms of real time capture and storage.

WS forum …

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 44
Time = Money

› In Product Development, Field Trials, Troubleshooting; Time = Money

› During an LTE development or roll-out project, explain the use of WS to management?
› “We’re trying to fix bugs in the freeware and getting help in online forums”
› “The freeware doesn’t yet support the latest standard”
› When a network is down, you don’t want to be stuck with a Freeware based tool.

› Need new features for a WS based tool?

› Contract developers ?
› Or use your own teams time?
› Do you put your project
on hold while waiting?

You wouldn’t fly in an aircraft that runs on Freeware,

so why risk your job on it?

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 55
Freeware can get Expensive

› Free stuff!? (Not really) WS aditional costs include

› R&D time -> How to install, build, configure, operate
› Schedule delays(or halt) while waiting for answers from public forum
› Delays due to hidden software bugs in Freeware
› In fact it often costs more money to use Freeware than professional solutions.

› EXFO NetHawk’s professional tools

› Professional support
› Quick response
› Freeware technical support is “hit and miss”

› Software bugs in Freeware are hidden and no one has the responsibility to fix them.

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 66
Technical Credibility

› M5 engineers interact with all major equipment

vendors on a daily basis.

› EXFO is always ready to answer your technical

questions and to help you confirm your findings.
Such service is not available for freeware.

› EXFO NetHawk ensures its solutions are up to date with the latest
revisions of protocols.
› EXFO also follows each new release of published standards e.g.
from 3GPP
› When highlighting interoperability issues between networks and
equipment it is nice to know that you have an accurate and up to
date M5 Protocol Analyzer for the job.

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 77
Freeware exposes your info

› Getting answers for Freeware issues

› It’s a Public forum, competitors also review
› In accordance with legal agreements?

› EXFO NetHawk support

› Confidential, secure
› From the experts

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 88
Your modifications to freeware, becomes freeware

› If you use freeware as part of the products you deliver, beware.

› The GPL imposes conditions on your use of GPL'ed code in your own products

› If your company produces a "derived work" from Wireshark, your customers must be
allowed to give away the resulting work.

› You must also make the changes you've made to the Wireshark source available to all
recipients of your modified version; those changes must also be licensed under the
terms of the GPL.

FREEWARE
INSIDE

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 99
Comparison:
WS Freeware
vs.
M5 Product

© 2010 EXFO Inc. All rights reserved.. 10

Tens of Thousands of Sessions over LTE Network?

› M5 can handle tens of thousands calls with the C&S application

› Wireshark can only handle one call at a time
› Wireshark does not have LTE Session analysis
› Wireshark simply doesn’t work in live network troubleshooting,
system testing and shared test laboratories
› M5 can handle multiple gigabits of single or periodic trace file data
› Wireshark is out of memory after a few hundred megs of signaling data

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 11
11
Encrypted Signaling—Automatic LTE NAS Deciphering

› NAS deciphering is mandatory in testing the live network

› M5 can decipher NAS-ciphered session in real-time
without limitations on the number of sessions
› Wireshark does not have NAS deciphering at all

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 12
12
Monitoring a Specific Session

› With WS, 1 message is showing details from multiple different calls. It can’t
sort the data into separate clear messages.
› With intelligent M5 SCTP chunk filtering, it is possible to isolate the signal
messages of a single session

M5
WireShark

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 13
13
Applications: Decoding

M5: Fully adjustable views for quick detailed analysis:

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 14
14
Message Flows: M5 vs. Wireshark (not in real time)

M5

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 15
15
Applications: Call & Session Analysis

› M5: extremely powerful tool from one session test case to live troubleshooting

› Wireshark: no call and session analysis at all

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 16
16
Call & Session Analysis User Cases

› Tracking or filtering with user IDs

over multiple interfaces (IMSI/GUTI (M-TMSI) )

› Finding the reason for dropped or failed sessions

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 17
17
LTE Air Interface Support, S1 C & S and Correlation

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 18
18
Applications: User-Plane Analysis

› M5: Graphical throughput/flow analysis

› 1-10 Gbit/s line rate

Live update of KPIs.

› WS: some counters with poor throughput (<20 Mbit/s)

› WS Limited by the speed of your own laptops NIC card
© 2011
2010 EXFO Inc. All rights reserved..
reserved. 19
19
Throughput Measurements Directly from C&S

› Throughput measurements are taken with the C&S analyzer using iPro DB
› Easy access to graphical throughput measurement report (right click menu)

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 20
20
Detailed Protocol Help Files in M5 (e.g., LTE S1-AP)

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 21
21
More Reasons to Choose the M5 Analyzer

› Clear and graphical illustrations of all different interfaces

› Multisession support
› LTE Session Correlation over all the interfaces
› LTE NAS Deciphering support (not available openly in Wireshark)
› Real-time support for user-plane analysis up to line rate (with iPro)
› M5 Sampo 3.0, supports up to 10 simultaneous users
› Full user-plane analysis and capturing capacity
› NSN eNB internal interface support: real-time feed of LTE air
interface signaling to M5 Analyzer
› As M5 is a professional tool, the user can troubleshoot or create test
reports 10 times faster than using Wireshark

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 22
22
NetHawk M5 vs. Wireshark Comparison Table

NetHawk M5 Wireshark
Copy/paste Yes, complete calls, colors, csv, etc. Only one row or packet
Filtering on hardware level Yes No
Accurate time stamping for delay measurements Yes No
Support for several Ethernet Yes No
adapters simultaneously
Dynamic Iub and Abis support Yes No
Support for Iub f8 and LTE NAS deciphering Yes No
Documentation Yes, complete protocol Poor
and GUI help
Multi-user support Yes No
Call tracing All technologies Sip only
User-plane and control-plane correlation Yes No
Call correlation over interfaces Yes over all technologies No

Product support Yes (four yearly releases with updates No (same well-known
and improvements bugs after years)

© 2011
2010 EXFO Inc. All rights reserved..
reserved. 23
23